ICT System for Courses in Computer Networking

Transcription

1 ICT System for Courses in Computer Networking IKT-system för kurser om datornätverk TOMI KAMPPI KTH Information and Communication Technology Degree project in Communication Systems First level, 15.0 HEC Stockholm, Sweden

2 ICT SYSTEM FOR COURSES IN COMPUTER NETWORKING ABSTRACT The project focuses on renewing the current ICT system in the 8 th floor server room, at KTH, Kista. The current ICT system, surrounding administrative tasks and user functionality are described, and a new improved ICTsystem proposal is given. The current and proposed systems are compared. The current ICT system gives users access to 16 Intel E7501, servers with 2.4 GHz Xeon processors, and GB of RAM, and 16 SUN Fire v120 servers. These servers are in the proposed ICT system replaced with hardware capable of running 64 bit software. The future ICT system proposal is based on VMware vsphere 4, and surrounding VMware management software. The solution focuses on providing a more flexible and easier administration of the environment, as well as more possibilities for the users, for example in the form of virtual networking configurations. The server room has networking equipment most notably in the form of HP switches, which are kept in the proposed system. The servers that support the server room are also incorporated into the proposed system, these supporting server provide the server room with all surrounding services. Due to hardware incompatibilities the proposed ICT system has not yet been implemented. SAMMANFATTNING Projektet fokuserar på att förnya det nuvarande IT system på 8: e våningen serverrummet, på KTH, Kista. Det nuvarande IT systemet, kring administrativa uppgifter och användarvänliga funktioner beskrivs, och ett nytt förbättrat IKT system föreslås. Det nuvarande och föreslagna systemen jämförs. Det nuvarande IT systemet ger användarna tillgång till 16 Intel E7501 servrar med 2,4 GHz Xeon processorer och 1,5 2 GB RAM och 16 Sun Fire V120 servrar. Dessa servrar är i det föreslagna IKT systemet ersättas med hårdvara som kan köra 64 bitars program. Det framtida IT system som föreslås bygger på VMware vsphere 4 och tillhörande VMware programvara. Lösningen fokuserar på att ge en mer flexibel och enklare administration av miljön samt fler möjligheter för användarna, till exempel i form av virtuella nätverkskonfigurationer. Serverrummet har nätverksutrustning främst i form av HP switchar som behålls i det föreslagna systemet. De servrar som stöder serverrummet har också införlivats i det föreslagna systemet, dessa stödservrar förser serverrummet med alla kringliggande tjänster. På grund av maskinvaruinkompatibilitet har det föreslagna IKT systemet ännu inte installerats. 1

3 TABLE OF CONTENTS ICT System for courses in computer networking... 1 Abstract... 1 Sammanfattning Introduction Purpose Scope Definitions, acronyms and abbreviations References Preface Use Cases Current ICT system Hardware Servers Network Administration Future ICT system proposal Software Hardware Network Administration Comparing current and future ict systems Non administrative comparison User rights management Powering on, off, and rebooting servers Operating system installations Network changes Summary Using UML to document the server room configuration Implementing a solutition using the current ICT Equipment Server room equipment limited to 32 bit architecture Licensing Centralizing management ESXi, a free hypervisor A theoretical example: Creating a corporate network Prodedure using the current ICT system Prodedure using the future ICT system References

4 1. INTRODUCTION The following chapter will cover the purpose, scope, definitions, acronyms, abbreviations, references, and overview of the project documentation. 1.1 PURPOSE The purpose of this project is to document the existing ICT system, and to develop an ICT system which is more flexible, simpler and more modern, from both the users and administrators point of view, of the 8 th floor server room in KTH in Kista, Stockholm. The project will also explore the possibility for documenting the existing and future server room with Unified Modeling Language ( UML ) SCOPE The project will improve the manageability of the server room by documenting the current configuration, including networking and common tasks performed. A proposal for an ICT system that replaces the existing configuration will be presented. Use cases are established, and they serve as requirements. The existing ICT system is documented by inspection of the current hardware configuration, and by using use cases that describe the different tasks a user must be able to do, and executing the necessary steps to satisfy the requirements of each use case. The new proposed ICT system is comprised by going over the current hardware and software configuration and finding the faults that reduce the flexibility and simplicity of the configuration, and then finding better suited alternatives to the current ICT system. The deliverables of this project can be split into two deliveries. Delivery one consists of: The current working ICT system, requirement specifications for that system, documentation over the hardware and tasks related to the use cases, and documentation that describes the roles of the administrator and the user. Delivery two consists of: A specification of the proposed future ICT system, documents that describe how the use cases are handled by the proposed ICT system. The project will attempt to use UML to document the server room equipment and network configuration. This is attempted to gain a better understanding of the uses of UML. 3

5 1.3 DEFINITIONS, ACRONYMS AND ABBREVIATIONS Unified Modeling Language (UML) is a standardized general purpose modeling language. ICT system describes a system consisting of computer hardware, software, data and users and administrators of this system. System refers to the ICT system. Use case describes a specific task that can be performed with the system. Hypervisor is also called a virtual machine monitor, and is the link between the hardware and guest operating system. 1.4 REFERENCES [Use case] [UML] 4

6 2. PREFACE Kungliga tekniska högskolan (KTH) is a technical University which provides education and research in Stockholm, Sweden. The education and research KTH provides is not only theoretical but needs real IT systems to educate its students and perform research tasks. For this purpose the school has multiple ICT systems spread out over the different campuses. This project focuses on an ICT system, with its hardware located in a server room on the 8 th floor of KTH Forum building in Kista, Stockholm. The ICT system must be able to handle multiple tasks related primarily to simulating other ICT systems. These tasks are documented with use cases and serve as requirements for the ICT system. Focus will be on documenting the current system for administrative purposes and on proposals for possible future upgrades and improvements to the system. The work can be divided into three parts, documenting the existing ICT system, finding a more suitable solution, and attempting to implement the new solution. 5

7 3. USE CASES This project uses use cases to determine the requirements for the ICT system. By using this approach it is easy to see specific tasks the system is able to perform The use cases for this system are Operating system installation Updates to operating system Use of Citrix Data backup Creation of network shares Resource management Performance tests Remote printing E mail solution Changes to the network structure System monitoring Simulation of company network 6

8 4. CURRENT ICT SYSTEM 4. 1 HARDWARE The server room holds all of the systems hardware besides some networking equipment for connecting to other ICTsystems. The hardware in the server room consists of: 16 Intel E7501 Chipset, 2X Xeon 2.4 Ghz, 1,5 2GB servers 16 SUN Fire v120 servers 1 HP Procurve 5308XL switch 2 HP Procurve G switches 1 HP Procurve 2626 switch 2 Digi Etherlite 32 Network serial concentrators 2 APC AP7920 Switched rack PDUs 1 SUN Fire v100 (Terminus) 1 SUN Fire v210 (Hera) 1 SUN StorEdge D2 1 SUN Enterprise 250 (Kuler) 1 x86 server (GIX) 1 AP9212 Masterswitch Power Distribution Unit 4.2 SERVERS In the server room, there are three servers that provide a lot of the functionality to the ICT system. The servers are: GIX, Hera, and Terminus. The characteristics of these three servers are described in here GIX The GIX server provides the server room with services such as Network Address Translation (NAT) 2, Domain Name Service (DNS) 3, Dynamic Host Configuration Protocol (DHCP) 4, and a Trivial File Transfer Protocol (TFTP) 5 service for Pre Execution Environment (PXE) 6 and Solaris Jumpstart HERA Hera is used as a fileserver, and runs services such for File Transfer Protocol (FTP) 8, Network File System (NFS) 9, and SAMBA TERMINUS Terminus is a console server that uses Secure Shell (SSH) 11 to encrypt the connections. Terminus is used for connecting to the console ports of the 16 Intel, and 16 SUN servers. 7

9 4.3 NETWORK The hardware devices listed in the previous chapter are connected via network cables in the following way: Figur 1: The logical VLAN network However the connections shown are only physical, the networking structure is more complex, and uses Virtual Local Area Networks (VLANs) 12. The Brand Rex device is used to connect the server room to other networks outside the scope of this project. There are multiple ways to configure VLANs, one is to let the devices communicating tag their own outgoing packets, this however requires configuration on every device. Another way to accomplish the same task is to assign each port on a switch to a specific VLAN. This solution is not dependant on the end devices being correctly configured. The down side is that if a device should be connected to a different port on a switch, the device could end up on the wrong VLAN. And it 8

10 also limits the server to being connected to only a single VLAN on a specific interface. In the server room, the VLANs are assigned with the latter approach. The switches are configured to place a port in a specific VLAN. The VLANs used are Default: Not assigned to any specific units. EXT: This is short for External. This VLAN is used to connect devices to the KTH main network and via the main network to the internet. 99: Not currently in use. 800: All 16 SUN Fire v120 and all 16 Intel E7501 Chipset servers are connected to this network. 950 Not currently in use. 999: All 16 SUN Fire v120 servers are connected to this network. And a series of VLANs ranging from g1 to g16: 16 Intel E7501 Chipset servers are connected to these networks, each of the servers is only connected to one VLAN, and in this VLAN there are no other units than that specific server. CON: This VLAN connects units that are part of the ICT systems console network. 9

11 4.4 ADMINISTRATION Multiple areas require administration in this ICT system, the most common tasks include Rights management Powering on and off machines, and hard restarts. Operating system installation Network changes User rights have to be managed in the ICT system, this task involves granting users access to the serial console of a server. Only the administrator is able to power on and off PC servers, if not shut down by a command from the operating system. Unresponsive servers can only be rebooted by the administrator. All of this is controlled by a script on the terminus server named apc.sh that resides under /root. This script controls the Switched rack PDUs, which handle powering off and on and rebooting. For the SUN servers the situation is different. Here the server can be managed through LOM (Lights out management) 13, which can handle everything and beyond what can be done with the apc.sh script. LOM can be accessed by anyone who has been given access to the serial console of the SUN servers. Operating system installation is a task performed very often since the servers are usually only used by one user for a short period of time, usually in the range of two months. To install an operating system the administrator must first get a server to boot; this is done with the apc.sh script described earlier. After the server starts up the administrator must connect to the server s serial console. The network has a Preboot Execution Environment ( PXE ) server which presents multiple locations from where to boot an operating system, most of which are on a server running the Trivial File Transfer Protocol ( TFTP ). The administrator can now choose to boot an operating system of the network device or locally, from a hard drive or for example CD ROM drive. Cloned image files have been made of the most common operating system installations, and can be installed with Partimage, open source disk backup software. Partimage is run from the TFTP server, and once run the administrator can issue a command to install a specific operating system, since the operating system is a clone of a previous installation, the rest of the process will proceed automatically. This installation procedure takes about 5 minutes per machine for the administrator to complete. However if a machine has not been cloned prior to the installation, the procedure will take considerably longer. If the operating system has not been previously installed and backed up for later use, the administrator uses the p Partimage utility to do this make the clone image. Network changes are seldom made due to the administrative work that goes into them. To make a change to the network structure requires changing the configuration of the switches; the users themselves have practically no way of designing their desired network structure. All the servers that the users control are connected to two VLANs, this configuration allows for some flexibility, for example users with three servers can use one of these servers to act as a router between these two VLANs, while the remaining two servers only use a connection to one VLAN. This simulates a slightly more complex network structure, but still has very limited capabilities. 10

12 5. FUTURE ICT SYSTEM PROPOSAL The future ICT system proposal uses VMware virtualization technology to create virtual servers. All equipment excluding the 16 Intel and SUN servers are still used in the same manner as in the current ICT system. The reason that some hardware is not included in this proposal is that the current 16 Intel and 16 SUN servers do not support 64 bit programs, and can therefore not run the proposed software. 5.1 SOFTWARE The new ICT system runs VMware vsphere 4 ( vsphere ) 14 with VMware vcenter server 4 ( vcenter ) 15, vsphere contains the core components VMware ESX 4( ESX ) 16 and VMware ESXi 4( ESXi ) 17. ESX and ESXi are so called bare metal hypervisors, which means that they install directly on top of physical hardware without the need for other operating systems, and then partition the physical hardware into multiple virtual machines. VMware vcenter is a management solution for vsphere, that allows us to manage multiple ESX servers from one centralized location. For this project ESX has been chosen instead of ESXi. This is due to a few important differences in functionality. Although ESXi uses a smaller resource footprint, it is not suitable to the schools ICT system due to lack of scriptable installations and serial cable connectivity. The lack of these features makes ESXi more difficult to administer from a distance, although just in the initial installation stage. Scriptable installations allow us to perform quick and easy installations and reinstallations of ESX onto the hardware; no user input is required other than starting the installation procedure. VMware vcenter can be used to control multiple physical servers, thus allowing for easy administration of the servers. To add an ESX option on a server a PXE boot server is recommended during the migration stage, as it will allow quick remote installations of the virtual machine hypervisors on all servers. Serial cable connectivity allows us to use serial concentrators and console ports to manage the servers from a distance via the already present terminus server and the serial concentrators. The console port management comes in handy when initially setting up the new ICT system, as it can be used for the initial configuration of the ESX servers, such as assigning IP addresses. Different versions of unmodified operating systems such as Microsoft Windows, Linux and SUN Solaris can be installed on ESX. To install an operating system we must have a virtual machine. Virtual machines with varying specifications can be created in ESX. When a virtual machine is chosen for the operating system installation, installation media containing the operating system must be present. ESX can store these installation files in data storages for easy access, from there presenting the user with the choice of some or all of the available operating systems. RELIABILITY As VMware ESX Server is a virtualization technology which entails running multiple virtual machines on a single physical server, there is an issue of reliability of the services being run. This issue arises from the presence of a single point of failure, in this case, the physical server running the virtual machines. If that server fails, all of the virtual machines on that physical server stop running, as opposed to a solution where only physical servers are used, where only one machines operation will be disrupted. ESX resolves this issue by using VMware High Availability ( VMware HA ) 18. VMware HA uses cluster pools for virtual machines. A cluster is a collection of virtual machines. When a machine is detected as being down in a cluster, ESX will attempt to migrate the virtual machines on that physical host to other resources that are part of the cluster. This reduces system downtime, and does not require manual input at the time of failure. The approach with VMware HA does of course require some additional configuration. 11

13 SCALABILITY Scalability is high with the virtual solution since we can manage resources given to any virtual machine very closely. This frees a lot of resources that in an all physical server environment could be lost on underutilized servers. Here we can add new virtual servers to physical servers with low load. Thus scalability of the system increases even without adding additional hardware. Another enhancement is that more powerful hardware can be added to the virtualized ICT system without reinstalling the virtual machines that are running. It is possible to move existing virtual machines from one physical machine to another. 5.2 HARDWARE The current hardware does not support 64 bit operation, and is incapable of running vsphere. The hardware remains unspecified, but has to conform to a few rules. The server hardware must be able to be controlled from the serial console or similar interface allowing the servers to be administered without an operating system and without a functioning direct network connection to the server. The servers need to support 64 bit operations. A minimum of 8GB of RAM is recommended for each server. 5.3 NETWORK PHYSICAL NETWORK The physical network can be configured in a similar logical manner as in the existing ICT system. But, the new system will need to use VLAN tagging between the physical servers, and the HP switches, as one VMWare server, will use more than one VLAN, and to have a redundant setup, multiple network interfaces on the servers, should be configured alike, as to provide redundancy between them. VIRTUAL NETWORK With ESX we can create virtual switches to which we can connect any virtual servers we like, even virtual servers running on separate physical servers. The advantage of this is that we can create networking structures without having to change the physical configuration in the server room. And if users are allowed to manage the virtual switches, the administrator has less tasks to perform. 12

14 5.4 ADMINISTRATION The administration of the ESX servers is handled from vcenter. vcenter installs on a Microsoft Windows operating system, and can be installed on a virtual ESX server. The major advantage of running vcenter on a virtual machine is that it can make use of VMware High Availability, meaning that vcenter will be more reliable since it is not dependent on a single physical machine. If vcenter is running directly on top of physical hardware without ESX in between, the problem of a single point of failure is introduced to the administration of the system. With vcenter, the administration is handled by using a client called vsphere client, this client is also bound to the Microsoft Windows operating system, and thus a Windows installation is required on the computers that are used to administer the virtual machines. If the physical hardware supports administration through a serial console, the terminus server needs to be aware of which users are allowed to administer the servers. It may be possible to incorporate the administration of both the servers of the current ICT system, such as terminus, and hera, with the administration of the proposed ICT system by using LDAP. Further study is required in this area. The administration of the servers works in the same way as in an active directory domain, and can even be integrated into an active directory domain. An administrator can give users permissions to certain virtual machines, physical machines, or groups of them, as well as permissions to create virtual networking configurations, and access to databases. Thus allowing the users to install the operating systems, and handle most networking tasks themselves. Physical networking changes are expected to be rare as most configurations can be achieved using the virtual networking solutions. Reboots of physical ESX servers and virtual machines can be handled by users if they have been granted administrative rights to those specific servers and the servers are responsive through the vsphere client. If however a physical server is unresponsive or the vsphere client for one reason or another cannot be used to control the hosts, the administrator is required to perform hard reboots of the servers. The ICT system has switched rack PDUs that can handle powering off and on physical hosts. 13

15 6. COMPARING CURRENT AND FUTURE ICT SYSTEMS This chapter s focus is on the administrative differences between the current and future ICT systems. But other relevant differences are also covered here. Administrative tasks such as rights management, network changes, powering on, off and rebooting servers, and operating system installations are discussed. 6.1 NON ADMINISTRATIVE COMPARISON A major difference between the current ICT system ( Current system ) and the future ICT system ( Future system ) is the fact that the latter provides users with virtual servers, instead of running these servers directly on hardware. And new 64 bit hardware is required to run the future system, which means that new server hardware is required before the future system can be implemented. 6.2 USER RIGHTS MANAGEMENT One of the tasks the administrator has is to give users rights to use a specific virtual or non virtual server. In the current system the administrator adds the users account name to a list of users allowed to access the console of a specific server via an SSH console. A solution that can be used in the future system is the administrator giving specific credentials to a user, but these not being connected to the users account. This way a group can use the same credentials to control the group s servers. With VMware ESX we also have the possibility to use active directory to manage users, however, this option may not be viable for the server room, as this would require either the server room being connected the school s active directory servers, or creating a new active directory domain. These credentials allow the user to for example have access to or even make changes to a specific virtual machine, physical host, virtual network gear, and data storages. All this can be handled with the VMware Virtual Infrastructure client ( infrastructure client ), and from one centralized location. A problem with the infrastructure client is that it is currently only available for Windows operating systems, which makes the current system is more independent of the operating system being used, since all common operating systems have SSH clients. 6.3 POWERING ON, OFF, AND REBOOTING SERVERS In the current system, if a server experiences problems and crashes, the users can not reboot the server by themselves, and need assistance from the administrator. This is solved in the future system as users who are given control of a virtual server, are allowed to reboot that server. If we consider powering off and on servers for the purpose of power saving, the future system advantage over the current system, at least if we assume that the new hardware s power consumption is on the current level. As users still do not have control of powering off and on physical servers. Another result of this is that if ESX itself experiences a crash, the users still require the assistance of the administrator. There is however a greater chance of continued operations on the future system, since the underlying ESX software is quite isolated from the virtual machines. 6.4 OPERATING SYSTEM INSTALLATIONS Because possible operating systems are chosen by the administrator and the administrator is needed when initiating an operating system installation on the current system. This changes with the future system, as the users themselves can be given rights to upload and install operating systems ( OS ) to the virtual machines they control. And the administrator is no longer required when initiating an OS installation. 14

16 6.5 NETWORK CHANGES Currently, very few networking changes are done by the administrator as they are cumbersome to perform. In the future system, users can themselves add networking equipment such as switches, and connect their virtual servers to these switches and different VLANs. 6.6 SUMMARY Rights assignment Current ICT system The administrator gives users rights to access the serial consoles from the terminus server. Proposed ICT system The administrator gives users rights to the parts of the virtual system that are required, for instance a specific virtual server and rights to add virtual switches. Network configuration The administrator changes VLAN or physical configuration of network. Users add virtual networking components, and connect their servers to these. Operating system installation The administrator starts a server and enters the PXE environment, where an operating system installation is started, or a backed up clone of a previous installation is written to the server. The user clones a saved virtual machine. Or uses stored installation files from an ESX database, or uploads own installation files to perform the installation. 15

17 7. USING UML TO DOCUMENT THE SERVER ROOM CONFIGURATION An attempt was made to create a document containing a map of the server room equipment, physical networking configuration and VLAN configurations. Microsoft Office Access 2007( Access ) was used to create this document. UML classes were created in order to create objects originating from these classes. One class would contain all necessary variables needed to describe a specific object. If for example multiple servers were to be created, a class describing a server was first created, and objects of that class were then the actual servers. A problem with this approach was that, an object could only be visible in a single view. So for instance a server, that we wanted to present in multiple contexts, could only be in one view, making UML, or at least the Access 2007 implementation of it, unsuitable for our purposes. 16

18 8. IMPLEMENTING A SOLUTITION USING THE CURRENT ICT EQUIPMENT 8.1 SERVER ROOM EQUIPMENT LIMITED TO 32 BIT ARCHITECTURE Most modern hypervisors use 64 bit addressing, and VMware ESX 4 is one of them. The equipment in the server room is based on 32 bit architecture, and thus incapable of running the latest version of ESX. There is however older versions of ESX that are 32 bit based, the latest being ESX LICENSING VMware in Solna, Sweden were contacted in order to obtain educational licenses to ESX 3.5, however they were unable to provide a license. There has been a trial version of ESX 3.5 available through VMware s webpage, but attempts to locate the trial version have failed. And even if the trial version had been obtained, it would not have met the required standards, as a major problem with it was that the trial period only spanned two months, and could have ended at a critical time, as university courses are in the same time range. 8.3 CENTRALIZING MANAGEMENT In order to manage the ICT system from one application, VMware s centralized management software suite, Virtual Center or currently called vcenter is required. Without the management solution, managing the servers becomes more cumbersome, as each server can then be described as an island, unaware of each other, and without any possibility to manage multiple servers at the same time. Each of these individual servers would have had to be logged onto, and as there are multiple servers, it would have been a major task for the administrator. However users would have been able to perform most of these required tasks. No attempts to contact VMware for 32 bit versions of this software suite were made, as we were unable to obtain ESX ESXI, A FREE HYPERVISOR VMware provides a free of cost hypervisor called ESXi. ESXi 3.5 is a 32 bit version, and is capable of running on the server room equipment SCRIPTED ESXI INSTALLATIONS A major difference between ESX and ESXi is ESXi s lack of scripted installations of the hypervisor itself. The lack of scripted installations means that ESXi does not support unattended installations, and require input from the person installing. And as one of the main project goals involves simplifying administration. However, once ESXi is installed on all machines, it is not very likely that it would need to be reinstalled frequently, other than for the purpose to clean the configuration, which can be done in other ways SERIAL CABLE ESXI ADMINISTRATION Unlike ESX, ESXi does not support directly connected serial cables. This is a problem for two reasons; firstly, since scripted installations are not supported by ESXi, and the remote administration interface does not function until the installation is completed, ESXi does not support remote administration during the installation. Second, troubleshooting can be more complicated if the problem involves network connectivity, since in cases where the Terminus server can be reached, but not the ESXi host, there is no way to administer the ESXi host. 17

19 8.4.3 ESXI TEST INSTALLATION ESXi was installed onto two servers in the server room. The installations functioned correctly, and there were no hardware or software problems. Dual virtual machines were created on both ESXi hosts; the Debian Linux 4.0 was installed on the virtual machines, and ran without issues. All machines on a single host were connected to a virtual switch, which was connected to the physical networking interface. The network connectivity was tested first between hosts on the same ESXi host, and then between virtual machines on different ESXi hosts. The test was successful CLONING ESXI INSTALLATIONS Since ESXi itself did not support unattended or remote installations, and access to the server room is limited and inconvenient, we had to come up with a new solution. The solution was cloning, where the idea was to make a single, fresh install of ESXi, and make a backup of this installation to the Hera server, and boot other machines via PXE and a backup solution, and overwrite the data on their hard drives with the backup created. The software used for creating the backup was CloneZilla. As of 24/3 2010, CloneZilla supports the VMware Virtual Machine File System( VMFS ), used by ESX and ESXi, and may speed up VMFS cloning operations substantially. As there was no support for VMFS at the time, a tool called dd. The dd tool is used for low level copying of raw data, and copies the data bit for bit, the advantage of this is that even unsupported file systems can be cloned, but the process is much slower. At the time of us cloning the ESXi installation, a single cloning operation took approximately one and half hours to complete. Problems arose when the backup was cloned onto a new server. As the server reboots, ESXi sends a DHCP request for an IP address. But ESXi has not noticed the changed MAC address of our host, and sends the request with the MAC address of the network interface on the server that was used for creating the backup. And this causes the DHCP server to give the same IP address to every cloned server. In the user menu of ESXi the new MAC address has appeared, but it is not being used for network communication, and is there all for show. Because of this, the solution with cloning ESXi installations was abandoned MODIFYING THE ESXI INSTALLER The ESXi installer presents the user with multiple screens during install, such as a welcome screen, and target selection screen and so on. This installer is uses a python scripts which control the process. By modifying the scripts it may be possible to automate the installation process, and by doing so, remove a lot of administrative burden. During the project the installer was not modified RESULTS This project was unable to implement a new suitable solution to the ICT system due to the problems described in this chapter. 18

20 9. A THEORETICAL EXAMPLE: CREATING A CORPORATE NETWORK 9.1 PRODEDURE USING THE CURRENT ICT SYSTEM A like scenario is when a group of users want to create a network with services that simulates a corporate network. In this chapter such a scenario is played out, and the different steps required for setting up the corporate network are described. In the real world, as well as in the server room, there are a lot of different ways to go about setting up the network and the services. For this reason, we will not use a generic scenario, but specify some popular services and thus be able to describe a theoretical real world example process from beginning to end. The group is already aware that no networking changes will be made, and the group will have to be able to come up with a solution using the existing network configuration. The group has been given use of a classroom in the Forum building in Kista. The equipment and services used by the group are: 3 x86 Intel servers of which one is running Debian Linux 5.0 ( Debian ) and two other are running Microsoft Windows 2003 Server ( Windows 2003 ). The layout of the corporate network they want to create is presented here: First, the users inform the system administrator that they want to create a new network with the three servers. And that they want to access the server room network from the classroom they have been assigned. The administrator will give permissions for the users in the group to access the servers through serial consoles. And then makes the necessary physical connections for the group to be able to access the server room network from the classroom. The users now have to let the administrator know which operating systems they want to install on their servers. The administrator now boots up the two servers that are going to rung Microsoft Windows 2003 Server, and via serial console, during the PXE boot menu, makes the choice to start partimage. Since Windows 2003 is a popular operating system in the server room, there is a backup version of it, on the Hera server, and the administrator uses partimage to overwrite the current disk content of the two servers with the backup containing a fresh install of Windows As Debian 5.0 was released recently, and therefore has not been installed on the server room servers prior to this, the administrator will have to go through the installation process with Debian. But since the administrator anticipates higher demand for the operating system in the future, the administrator decides not to go through this installation procedure multiple times, and therefore intends to create a backup clone of the hard drive of the server he installs it on. Debian

21 has been downloaded by the administrator and burnt to a CD. The administrator inserts the CD in the server the group is going to be using, and installs the operating system, where after he creates the backup. The users can now access their freshly installed operating systems through the serial console. And will have to view the IP addresses that the DHCP server provides them. On the Windows 2003 servers they now create a Special Administration Console ( SAC ), to enable Remote Desktop, and be able to connect to the machines using the Windows utility Remote Desktop Connection. On the Debian server they make sure the service for SSH is running, and connect through that instead of the serial console. All of the three servers are connected to two VLANs, one for each network interface. The group wants to leave both interfaces active on the Debian servers, since it will act as a firewall in their network, connecting the DMZ and the internal network. But they disable one of the network interfaces on both Windows 2003 servers, so that one is connected only to the DMZ, and the other to the internal network. They now have their network configuration setup. Now it is time to start installing software, and configuring the services. The group enables routing on the Debian server, and sets up iptables rules to only allow the internal network to create connections towards the DMZ and Internet, and not the other way around. The group then installs ISS on the Windows 2003 server, residing in the DMZ. And then configures it to serve web pages. The internal Windows 2003 server is used an e mail server. The group configures iptables on the Debian server to allow for e mail traffic to the server. And then installs Exchange Server 2003 on the internal Windows 2003 server. PRODEDURE USING THE FUTURE ICT SYSTEM The users start by informing the administrator that they want three servers. The administrator then creates the three virtual machines, and assigns the users rights to control them. The users then sign on to the servers through the VMWare vsphere client, and bring up the graphical interface. From there they can configure everything, as they would be sitting by physical servers with a screen and keyboard/mouse. Users themselves can now install operating systems without the help from the administrator; they can also change the virtual networking structure by adding and configuring VMware s virtual switches. If needed, the administrator could have created templates or cloned installations of the operating systems, which the users could have used to quickly create functional virtual machines. This way the administrator can make sure that the operating systems running in the future ICT system are identical to the resulting installations in the current ICT system. The users then go through the same configuration steps as performed in chapter 9.1 after accessing the server through the console ports. 20

22 REFERENCES 1 UML 2 NAT 3 DNS 4 DHCP 5 TFTP 6 PXE 7 Solaris Jumpstart 8 FTP 9 NFS 10 SAMBA 11 SSH 12 VLAN 13 LOM 14 vsphere support/vsphere/ 15 vcenter server/overview.html 16 ESX and esx/index.html 17 ESXi and esx/index.html 18 Vmware HA availability/overview.html 21

23 TRITA-ICT-EX-2011:283